Deserialization Vulnerability in Drupal Single Content Sync Plugin
CVE-2026-118562

7.2HIGH

Key Information:

Vendor

Drupal
Status
Single Content Sync
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118562?

The Single Content Sync plugin for Drupal is susceptible to a deserialization vulnerability that enables object injection when handling untrusted data. This issue could potentially allow attackers to manipulate data structures and execute arbitrary code, posing a significant security risk. Affected versions range from 0.0.0 to 1.4.19, and it is crucial for users to update their installations to mitigate this threat. Regular security audits and updates are recommended to safeguard web applications.

Affected Version(s)

Single Content Sync 0.0.0 < 1.4.19

References

https://www.drupal.org/sa-contrib-2026-275

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Drew Webber (mcdruid)
Drew Webber (mcdruid)
Oleksandr Kuzava (nginex)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Lee Rowlands (larowlan)
Drew Webber (mcdruid)
Juraj Nemec (poker10)
Jess (xjm)
.